--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d324092012d8b7c4dda17720255575963c9e35fcd86e254541cdf7abb5edffcf) On require() of this package, index.js loads _compat.js which reconstructs destination hostnames from string-split arrays (e.g. "oob-worker.cf102-baf.workers"+".d"+".ev") to fetch a platform-specific binary via https.get, with a DNS-TXT chunked fallback across tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site. The downloaded bytes are written to /var/tmp or %TEMP% under disguised names (`.cache_<rand>`, `dotnet_diag_<rand>.exe`, `.analytics_state`), chmod'd 0755, and spawned detached via `cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true})` on POSIX or `cmd.exe /c start /b` on Windows, with no hash or signature verification. lib/telemetry.js contains a second dropper of the same shape, loading child_process via `require("child_"+"process")` string-split, assembling a base64-chunk buffer, and chmod+exec'ing an "extension" path. The package's stated purpose is a "company id models" library; the network destinations, obfuscation, cover-story filenames, and platform-gated execution are unrelated to that purpose and match a supply-chain dropper campaign.